Computer viruses, or simply “viruses,” are executable programs or procedures, often masquerading as legitimate files, messages or attachments that cause malicious and sometimes destructive results. More precisely, computer viruses include any form of self-replicating computer code which can be stored, disseminated, and directly or indirectly executed by unsuspecting clients. Viruses travel between machines over network connections or via infected media and can be executable code disguised as application programs, functions, macros, electronic mail, (email) attachments, images, applets, and even hypertext links.
The earliest computer viruses infected boot sectors and files. Over time, computer viruses became increasingly sophisticated and diversified into various genre, including cavity, cluster, companion, direct action, encrypting, multipartite, mutating, polymorphic, overwriting, self-garbling, and stealth viruses, such as described in “Virus Information Library, ”, Networks Associates Technology, Inc., (2001), the disclosure of which is incorporated by reference. Macro viruses are presently the most popular form of virus. These viruses are written as scripts in macro programming languages, which are often included with email as innocuous-looking attachments.
The problems presented by computer viruses, malware, and other forms of bad content are multiplied within a bounded network domain interfacing to external internetworks through a limited-bandwidth service portal, such as a gateway, bridge or similar routing device. The routing device logically forms a protected enclave within which clients and servers exchange data, including email and other content. All data originating from or being sent to systems outside the network domain must pass through the routing device. Maintaining high throughput at the routing device is paramount to optimal network performance.
Routing devices provide an efficient solution to interfacing an intranetwork of clients and servers to external internetworks. Most routing devices operate as store-and-forward packet routing devices, which can process a high volume of traffic transiting across the network domain boundary. Duplicate messages, however, introduce inefficiencies and can potentially degrade performance. For example, a message can be sent with multiple recipients who each receive a separate copy. Nevertheless, the routing device must process each duplicate message as if the message were unique.
A firewall can be used with a routing device to provide limited security. The firewall filters incoming packets to deny access by unauthorized users. Thus, the firewall can protect indirectly against the introduction of computer viruses and other malware into a network domain. As each duplicate message must still be scanned prior to delivery, a firewall does not relieve packet congestion at a network boundary and can actually degrade throughput by delaying delivery.
The bottleneck created by the routing device and firewall create a security risk that can be exploited in a denial of service (DoS) attack. The “ILOVEYOU” virus, released in May 2000, dramatically demonstrated the vulnerability of network infrastructure components by propagating copies of emails containing the virus using addresses obtained from a user address book on each client system. Each email message contained identical content but listed a different recipient. The resultant email flood saturated servers with massively duplicated copies of substantially the same email and denied service through resource depletion and network bandwidth consumption.
Most firewalls failed to detect the presence of the “ILOVEYOU” virus. Firewalls require a priori knowledge of network addresses corresponding to proscribed servers to effectively filter out potentially bad packets. Therefore, infected emails were delivered and unwittingly opened by unsuspecting users, creating a flood of infected message traffic.
Active packet scanners can be used in lieu of or in addition to firewalls to dynamically analyze an incoming packet stream at a network domain boundary. Each packet is intercepted and analyzed while in transit into a protected enclave. However, active scanners can adversely affect the timing of packet delivery. Detecting computer viruses, malware and other bad content embedded in upper layer network protocols, in particular, at the transport and application layers, requires the analysis of a stream of lower layer packets collectively comprising upper layer messages. Interrupting the flow of the packet stream, though, can cause the recipient client to timeout and erroneously generate a retransmission request, thereby hindering throughput. As well, active scanners are installed at the gateway and require administrator-level permissions and privileges and create further potential security risks.
Therefore, there is a need for an approach to passively screening a multiplicity of substantially duplicate message packets transiting the boundary of a network domain. Preferably, such an approach would detect protocol-specific computer viruses, malware and other bad content without causing an interruption of an incoming data packet stream.
There is a further need for an approach to identifying patterns in a transient packet stream for events indicative of a network service or similar type of attach, preferably in combination with the detection of computer viruses, malware and other bad content.